Questions tagged [encoding]

Encoding is a set of predefined rules to reversibly transform a piece of information in a certain representation into a completely different representation. The other way round is called decoding.

Filter by
Sorted by
Tagged with
0
votes
0answers
48 views

How do you generate a RSA private key that is BER encoded with OpenSSL?

According to the Linux Kernel's Asymmetric Cipher API found at the following URL: https://www.kernel.org/doc/html/latest/crypto/api-akcipher.html#asymmetric-cipher-api, you must pass a BER encoded ...
0
votes
1answer
80 views

How to fix XSS in rails

I am able to inject javascript:alert `1` or javascript:alert(1) into the href field of the rails app and it is getting executed as JavaScript. Html encoding is already implemented but it doesnt encode ...
1
vote
2answers
122 views

Weird character sequence in email subject

I've noticed that the subject in one of the spam emails looks like this in source: Subject: Offe=?UTF-8?Q?=EF=BB=BF?=r fr=?UTF-8?Q?=EF=BB=BF?=om C=?UTF-8?Q?=EF=BB=BF?=redi=?UTF-8?Q?=EF=BB=BF?=t On=?...
0
votes
1answer
61 views

Server error when entering a percent symbol in search? [closed]

Fuzzing a website and came across an odd behavior. The site has a search bar, it sends queries via a GET request with the standard ?q= parameter. When I try the standard XSS payloads such as <...
0
votes
0answers
62 views

How to determine the encoding used when you have the data not the source code [duplicate]

The source code converts the data as below: 00000 - 62F0CBA67EA6A2C03D399A1B06D82787CB46480370FDA0C1CF5016E59A61F0A6 000000 - F657FC2120036C2EF29AF87E4194539B1728AB2F204676E413C6FFD5970453B9 ...
0
votes
0answers
13 views

Is there any identification for common encoding/encryption? [duplicate]

While pentesting (web application) I come across lots of tokens which might be simply encoded and not random, but I don't know any way to identity if they are encoded or random, how to find is there ...
5
votes
1answer
146 views

Do ciphers and encoding schemes make passwords more secure?

I recently came across a tech professional advising a user to take some plaintext of their choice, run it through one of these ciphers, convert it to Base64, and then use the result as their master ...
-2
votes
1answer
84 views

how to decode this request [closed]

I need help for this. I got a request but I don't know what can I do: GET http://localhost/xor.php?plaintext=cipher=%00%00%1D%10%1A,%06%05%16%16%0D%12%0B%3A9%5DRT%06YVD HTTP/1.1 Full request : https:...
1
vote
0answers
140 views

Problem with Reverse Engineering GVM light, possibly encoding issue

So I bought this GVM-560AS LED photography light on Amazon. It is a really good light for the job; but to control it remotely you have to download a really dodgy APK from the GVM website, a package ...
0
votes
3answers
146 views

What string encoding options are there besides xor? [closed]

When attempting to obfuscate strings in a modern program, xor is probably the most common option. By this I mean running each char of a string through a function which xors the char with some given ...
1
vote
0answers
53 views

rar and zip password encoding scheme [closed]

What encoding scheme is used in last versions of ZIP archives(6.3.2+) and RAR archives(3.90+), including RAR5? UTF-8/16, ASCII or something else?
-1
votes
1answer
146 views

What's the purpose of Base64 if knowing its Base64 makes it easy to decode

The title I think gets the point across. Lets focus solely on these hypothetical situations: Basic Auth headers when making API calls with user:pass Storing passwords in an SQL database What makes ...
1
vote
0answers
45 views

What exactly is URL-safe Base 64 encoding? [closed]

And how is it different form the normal Base 64 encoding?
1
vote
1answer
112 views

Encoding ASCII character as three-byte UTF-8. How does it work?

I'm reading a report on HackerOne https://hackerone.com/reports/52042. An input filter was bypassed by sending %E5%98%8A that was then parsed as 0x0A character (new line). The %E5%98%8A sequence ...
1
vote
0answers
74 views

Help needed in identifying a string [closed]

I need help in identifying the following string in order to decode it to a piece of meaningful information. h_t_s_/_g_s_._k_l_b_c_m_4_9_a_k_6_f_8_4_8_e_e_r_9_3_9_f_
3
votes
3answers
1k views

Encoding output in JSON HTTP API

I'm the author of a JSON REST API. This REST API is consumed by various clients, such as HTML/JS-clients, .NET clients (console applications) and Ruby clients. The output of the API is in JSON format, ...
2
votes
3answers
197 views

Is it risky to URL-encode characters in an already URL-encoded string?

I'm maintaining a legacy web application which is composed of the application itself, accessible to the public, and the REST services which can be accessed only by the application through the LAN. At ...
0
votes
2answers
209 views

is encoding the same as encryption for malware obfuscation?

I have been learning about hiding and executing msfvenom created shellcode and came to a technique where we xor the shellcode and when executing we reverse it.Would it be the same if i just encrypt it ...
0
votes
3answers
480 views

Why doesn't XSS execute when bypassing HTML encoding?

I am trying to execute an XSS payload on a search field that takes my input like this: <input name="q" id="gsasearch" type="text" value="My Input"></input> Observations: <, > and "...
1
vote
0answers
156 views

Help figuring out this hash function [closed]

I have a tough nut to crack. I'm working on hashing passwords for our network switches (because the alternative is plain-text passwords...). For people who would care about this; it's a huawei switch. ...
0
votes
1answer
165 views

Odd characters — including a backslash — in magstripe track 1 name field?

I've been in the Point of Sale industry for decades. Parsing card magnetic stripe track 1 data has never been difficult, but lately we've started to see some odd data in the name field of cards that ...
0
votes
1answer
36 views

Problem identifying this encoding schematic into plain text [duplicate]

Im really new to all of this i'd like some insight. the encoding scheme looks like this e0b7 e51f a24f 2ee8 f950 ecc4 d46b 6b3b 11bd 1930 ccb0 3c9f ecf5 368d f570 c72d a37e 47a6 bf03 2cf4 947c e913 ...
0
votes
2answers
6k views

XSS with URL encoding

If a website URL gets encoded then is the website still vulnerable to XSS or no? For example, if I try <script>alert(1)</script> and the site URL encodes my payload to %3Cscript%3Ealert(1)...
3
votes
2answers
567 views

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context?

Is reflected XSS impossible, when HTML meta-characters, e.g., < and >, are encoded, and the result output in HTML context? I have a website that displays the URL path directly in HTML context, i.e....
3
votes
1answer
154 views

Exploit user input being directly inserted into PDF

I'm testing a web application where user input is directly inserted into a PDF file which can then be downloaded. The user input is accepted as is, without encoding or any other modification. This ...
0
votes
1answer
237 views

Is a substring of base64 encoded random_bytes less secure then just using random_bytes

$bytes = random_bytes(15); $encoded = base64_encode($bytes); $output = substr($encoded, 0, 15); Does this code affect the complexity of the output vs just using $output = random_bytes(15); I think ...
1
vote
1answer
497 views

ASN.1 encoding of X25519 private key

I'm using mbed TLS for ECDH key agreement using Curve25519. The private and public keys are stored and transmitted as Hex strings as easily generated with mbed TLS. Those strings are big-endian. This ...
0
votes
1answer
55 views

SQL Query Sanatization

It seems to me SQL injection could be avoided by just converting everything to a simple encoding like base64 that doesn't have any harmful symbols. In the classic query "SELECT * FROM users WHERE ...
1
vote
0answers
75 views

Server improperly handling unicode characters?

So I'm pen-testing a web application. Upon submitting certain data it sends it in a POST request which contains the data in a JSON object. So while fuzzing it I was testing for improper encoding ...
4
votes
1answer
410 views

Hydra - Attacking when login page encodes the username and password

I needed to test how Hydra works, so I tried to attack my own wifi router. I set the user name as "user" and created a txt file containing 100 passwords including the "real" password. I am unable to ...
2
votes
0answers
426 views

Security risks with pdf files in object tag at client/server side

This is my situation: a user uploads a pdf file to my server. The data travels encoded in base64 (like a regular input in a form). The base64 is saved in one particular file on my server. Now, another ...
23
votes
1answer
5k views

When and why does bypassing XSS sanitizers with double encoding work?

I have read in different sites about different ways to bypass XSS sanitizers, like double encoding special characters such as /<>:"', or employing different encoding schemes. However most of ...
0
votes
2answers
760 views

Is it safe to get html encoded data from database to prevent stored XSS attack?

for security purpose now i'm fetching all data from database with htmlEncoded format. it is correct? please help..
1
vote
0answers
109 views

Exploiting XSS when attack vector is passed in Javascript context after being HTML encoded?

My attack vector is being passed in three contexts. HTML element: <p>injection</p> HTML attribute value: <input value="injection"> Javascript: <script> var a = "...
0
votes
0answers
1k views

Should Content-Encoding deflate be disabled [duplicate]

After scaning web page with Nikto I have results that is "The Content-Encoding header is set to "deflate" this may mean that the server is vulnerable to the BREACH attack." How to verify if that ...
5
votes
1answer
900 views

Why context sensitive encoding to prevent XSS?

OWASP recommends that context-sensitive encoding needs to be done. Please help me in getting a couple of strong "code examples" on why context sensitive based encoding needs to be done and why HTML ...
8
votes
3answers
3k views

How is character encodings used to bypass XSS sanitizers?

I read in different blogs that PHP htmlspecialchars() function has certain problems when one does not give the expected charset as an optional parameter. Can someone explain some basic stuff about ...
2
votes
1answer
79 views

Decoding requests from potentially malicious Android app

I have recently been doing some security evaluation work on our Android applications, by proxying all the communication through Burp Suite. I noticed one of our devices was sending requests to a ...
2
votes
1answer
140 views

Does the ECDSA signature value (of an OCSP response) need to be DER encoded

In OCSP responses by a certain eIDAS PKI I every once in a while get signature values which, when unpacked from their BIT STRING, contain an ECDSA signature whose INTEGER constituents have an ...
1
vote
1answer
359 views

Is it possible to “encode” a bash sentence?

I was recently solving a CTF challenge that I found quite strange, first of all I have been given a chain of characters that no matter how hard I try to find an answer I can not find it, I am going to ...
0
votes
2answers
226 views

Would using a QWERTY keyboard with DVORAK output cause keylogger to log DVORAK?

I have QWERT keyboard, but I have set the keyboard settings in Windows to DVORAK. So if I type "test" it comes out as "y.oy". Would the key logger log "test" or "y.oy" in its records?
2
votes
1answer
826 views

AngularJS Sanitize function vs. server-side output encoding

I mainly audit web applications and provide the companies with security countermeasures and recommendations. Currently, I have an issue with giving a correct recommendation when it comes to AngularJS ...
4
votes
1answer
4k views

Bypassing browsers URL encoding to do reflected XSS from query parameter?

I tried to get reflected XSS in vulnerable website with a request to the following URL: https://vulnerable.website/dir/dir?param1=test"><svg/onload=alert(1)> The browser URL encode the ...
2
votes
3answers
142 views

What are some potential attacks that could be done to a website that doesn't manage url-encoding properly?

A month or so ago I was in the middle of one of my "Distributed Applications" classes and the professor was explaining us how to """properly""" authenticate users in a server. To demonstrate how to ...
2
votes
1answer
284 views

Phishing email with encoded url params

I received a phishing email with the following format: hxxp://<%legitimateSite%>/~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%23$%25%5e&*()+~!@%23$%25%5e&()_+~!@%23$%25%5e&()+~!@%...
0
votes
2answers
241 views

padding problem in sha-1 hashed password

For my own understanding of Websphere LTPA keys, I'm running this Java code, which works correctly when using the author's Base64 encoded, SHA1 hashed password: String ltpa3DESKey = "...
0
votes
1answer
752 views

Explanation of illegal multi-byte encoding leading to XSS

I'm reading this report on unicode security and found the following paragraphs confusing: When converting from a multi-byte encoding, a byte value may not be a valid trailing byte, in a context ...
0
votes
1answer
182 views

What type of encoded text is this and how can I translate it? [duplicate]

I have no experience, but I've been playing a game and it's rather interesting. One of the character files has a long line of scrambled text and I was wondering if someone could tell me if it's ...
1
vote
0answers
104 views

Are JSON key names vulnerable to alternate encoding (CAPEC-267) attacks?

It's sometimes possible to use an alternate encoding to get around security checks (CAPEC-267). While the JSON spec may be strict on what is valid, popular parsers don't necessarily conform perfectly [...
1
vote
1answer
867 views

Does storing Base64 encoding of scrypt password hash make it more vulnerable?

Scrypt produces a binary hash of a password. Instead of storing it as bytes directly, we are considering to store the Base64 encoding of this string. Would that make the password hash more vulnerable ...